Dynamic modules TLS certificate selector
The DynamicModuleTlsCertificateSelector configuration specifies a custom TLS certificate selector backed by a dynamic module. For each handshake the module selects one of the configured certificates, lets Envoy select one, or selects a dynamic certificate that it provides at runtime.
Once the TLS context is ready to serve handshakes, its dynamic certificates are listed by the
/certs admin endpoint, without the trusted certificates that
the TLS context lists itself, and they count in the server.days_until_first_cert_expiring and
server.seconds_until_first_ocsp_response_expiring statistics.
Statistics
With allow_dynamic_certificates set, the selector emits the following statistics. For downstream listeners, they are in the listener.<address>.dynamic_certificates. namespace, or listener.<stat_prefix>.dynamic_certificates. if stat_prefix is non-empty. For filter chains from the Filter Chain Discovery Service (FCDS), they are in the dynamic_certificates. namespace. For upstream clusters, they are in the cluster.<name>.dynamic_certificates. namespace, or cluster.<alt_stat_name>.dynamic_certificates. if alt_stat_name is non-empty.
Name |
Type |
Description |
|---|---|---|
requested |
Counter |
Total number of dynamic certificate requests to the module |
provided |
Counter |
Total number of dynamic certificates that the module provided and Envoy accepted |
rejected |
Counter |
Total number of dynamic certificates that the module provided and Envoy rejected |
removed |
Counter |
Total number of dynamic certificates removed by the module or because they failed with an updated TLS context |
active |
Gauge |
Number of dynamic certificates that are served |
pending |
Gauge |
Number of dynamic certificate requests that wait for the module |